UTIOM · Assessment Toolkit

Three instruments for measuring a security operation

Self-hosted tools built on the Unified Threat-Informed Operations Model. Each answers a different question, and together they form a sequence: where you are, what to fix, and whether the fix worked.

Your answers stay in your browser. The tools have no backend, no database and no analytics. Nothing you enter is transmitted or stored anywhere. A web server records that a page was requested, as every site does, but never what you scored. If you would rather it not even see that, run the toolkit yourself using the download below.

Run them in this order

Each tool stands alone, but the sequence is deliberate.

01

Maturity assessment

45 criteria · staged
Where are we, honestly?
Forty-five gated criteria across the six UTIOM maturity levels. Staged rather than averaged, so a single unmet criterion at a lower level caps the result — because advanced practice built on a missing foundation does not compound.
Start the assessment →
02

Capability assessment

93 indicators · scored
What should we fix first?
Ninety-three indicators across ten lifecycle domains, each scored zero to five and cited back to the framework. Produces a score per domain and names the three weakest, weighted so a foundational gap cannot hide behind operational strength.
Start the assessment →
03

Metrics calculator

70 metrics · leading and lagging
Did the fix work?
Seventy metrics with explicit formulas. Follows the lifecycle in order — vision, strategy and crown jewels before visibility and detection. Time-based metrics are scored against your assumed adversary breakout time.
Open the calculator →

Run it yourself

The whole toolkit is a handful of static HTML files. Download it and open index.html, or run the included container to host it inside your own network. Useful when assessment answers should not leave the building.

Download the toolkitZIP, includes Dockerfile

About the framework

UTIOM is a lifecycle-based operating framework that connects leadership intent, threat-informed engineering, and incident response into one coherent, measurable system. It focuses security operations on crown jewels and real adversary behaviour rather than on tool coverage and alert volume.

The complete framework — lifecycle, maturity model, implementation blueprint, metrics and industry use cases — is available free at utiom.de.